Computer Law Commons^™

Privacy Statements Under The Gdpr, Mike Hintze

Seattle University Law Review

The need to include specific types of information in a privacy statement is a GDPR compliance obligation that does not get as much attention as some other GDPR requirements. Perhaps that is because privacy statements have been much maligned in recent years. They are too long and full of legalese. Nobody reads them. They are part of a notice and consent approach to privacy that puts an unrealistic burden on consumers to make informed choices. But despite these well-known criticisms, the GDPR doubles down on privacy statements. In fact, gauging by the roughly fourfold increase in privacy statement requirements compared …

Requiem For Cyberspace: The Effect Of The European General Privacy Regulation On The Global Internet, Steven Tapia

Seattle University Law Review

The dream of a perpetual, limitless, non-dimensional space is an idea that has transfixed clergy, philosophers, and poets for ages. Whether it is called “heaven,” “the afterlife,” “nirvana,” or another linguistic stand-in, the dream of a dimension beyond the bounds of time, space, and the laws of nature seems as universal as any concept ever. From its initial development in the 1970s (as a military, academic, and governmental experiment in creating a wholly alternative means of communication capable of surviving catastrophic failures of any parts of the communications conduits) until essentially now, the Internet seemed to be the closest incarnate …

Footprints: Privacy For Enterprises, Processors, And Custodians…Oh My!, Blair Witzel, Carrie Mount

Seattle University Law Review

Americans’ interest in privacy—as evidenced by increasing news coverage, online searches, and new legislation—has grown over the past decade. After the European Union enacted the General Data Protection Regulation (GDPR), technologists and legal professionals have focused on primary collectors of data—known under various legal regimes as the “controller” or “custodian.” Thanks to advances in computing, many of these data collectors offload the processing of data to third parties providing data-related cloud services like Amazon, Microsoft, and Google. In addition to the data they have already collected about the data subjects themselves, these companies now “hold” that data on behalf of …

Non-Autonomous Artificial Intelligence Programs And Products Liability: How New Ai Products Challenge Existing Liability Models And Pose New Financial Burdens, Greg Swanson

Seattle University Law Review

This Comment argues that the unique relationship between manufacturers, consumers, and their reinforcement learning AI systems challenges existing products liability law models. These traditional models inform how to identify and apportion liability between manufacturers and consumers while exposing litigants to low-dollar tort remedies with inherently high-dollar litigation costs.11 Rather than waiting for AI autonomy, the political and legal communities should be proactive and generate a liability model that recognizes how new AI programs have already redefined the relationship between manufacturer, consumer, and product while challenging the legal and financial burden of prospective consumer-plaintiffs and manufacturer-defendants.

Gdpr Compliance—It Takes A Village, Susy Mendoza

Seattle University Law Review

When the General Data Protection Regulation (GDPR) came into effect in May of 2018, many legal departments were confronted with the gravity of just how they were going to comply with such a wide-reaching law. If you have international customers (both direct to consumer or business to business), it is not hard to convince your general counsel that compliance with the GDPR is a must. You may even be able to get the chief technical officer (CTO) or chief operating officer (COO) onboard just by mentioning the steep fines—two to four percent of worldwide gross revenue. But how does the …

The Indecency Of The Communications Decency Act § 230: Unjust Immunity For Monstrous Social Media Platforms, Natalie Annette Pagano

Pace Law Review

The line between First Amendment protection and the innovation of social media platforms is hazy at best. Not only do these platforms increasingly encompass the lives of many individuals, but they provide incredible new opportunities to interact from near and far, through sharing photographs, videos, and memories. The Internet provides countless outlets that are available at the tip of users’ fingers: thriving forums to communicate nearly whenever and wherever desired. Users effortlessly interact on these platforms and are consistently exposed to numerous forms of speech, including messages through posts, chat room discussions, videos, polls, and shared statements. From 2010 to …

Platforms, The First Amendment And Online Speech: Regulating The Filters, Sofia Grafanaki

Pace Law Review

In recent years, online platforms have given rise to multiple discussions about what their role is, what their role should be, and whether they should be regulated. The complex nature of these private entities makes it very challenging to place them in a single descriptive category with existing rules. In today’s information environment, social media platforms have become a platform press by providing hosting as well as navigation and delivery of public expression, much of which is done through machine learning algorithms. This article argues that there is a subset of algorithms that social media platforms use to filter public …

Peeling Back The Onion Of Cyber Espionage After Tallinn 2.0, David A. Wallace, Amy H. Mccarthy, Mark Visger

Maryland Law Review

Tallinn 2.0 represents an important advancement in the understanding of international law’s application to cyber operations below the threshold of force. Its provisions on cyber espionage will be instrumental to states in grappling with complex legal problems in the area of digital spying. The law of cyber espionage as outlined by Tallinn 2.0, however, is substantially based on rules that have evolved outside of the digital context, and there exist serious ambiguities and limitations in its framework. This Article will explore gaps in the legal structure and consider future options available to states in light of this underlying mismatch.

Debugging The Tallinn Manual 2.0'S Application Of The Due Diligence Principle To Cyber Operations, Colin Patrick

Washington International Law Journal

As global cyber connectivity increases, so does opportunities for large-scale nefarious cyber operations. These novel circumstances have necessitated the application of old-world customs to an increasingly complex world. To meet this challenge, the Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations was created. The Manual provides 154 black letter rules detailing how international law applies to cyber operations during peacetime. Of particular import is the Manual’s interpretation of the due diligence principle. This principle, which defines the contours of a state’s obligation to prevent their territory to inflict extraterritorial harm, is increasingly significant in light of the …

Cybersecurity Oversight Liability, Benjamin P. Edwards

Georgia State University Law Review

A changing cybersecurity environment now poses a significant corporate-governance challenge. Although some cybersecurity data breaches may be inevitable, courts now increasingly consider when a corporation’s officers and directors may be held liable on theories that they acted in bad faith and failed to adequately oversee the corporation’s affairs. This short essay reviews recent derivative decisions and encourages corporate boards to recognize that in an environment filled with increasing threats, a reasonable response will require devoting real resources and attention to cybersecurity issues.

Online Terms As In Terrorem Devices, Colin P. Marks

Maryland Law Review

Online shopping has quickly replaced the brick-and-mortar experience for a large portion of the consuming public. The online transaction itself is rote: browse items, add them to your cart, and check out. Somewhere along the way, the consumer is likely made aware of (or at least exposed to) the merchant’s terms and conditions, via either a link or a pop-up box. Such terms and conditions have become so ubiquitous that most consumers would be hard-pressed to find a merchant that doesn’t try to impose them somewhere on their website. Though such terms and conditions are pervasive, most consumers do not …

Bone Crusher 2.0: The Fourth Annual Greg Lastowka Memorial Lecture, James Grimmelmann

Cornell Law Faculty Publications

No abstract provided.

Digital Forensics, A Need For Credentials And Standards, Nima Zahadat

Journal of Digital Forensics, Security and Law

The purpose of the conducted study was to explore the credentialing of digital forensic investigators, drawing from applicable literature. A qualitative, descriptive research design was adopted which entailed searching across Google Scholar and ProQuest databases for peer reviewed articles on the subject matter. The resulting scholarship was vetted for timeliness and relevance prior to identification of key ideas on credentialing. The findings of the study indicated that though credentialing was a major issue in digital forensics with an attentive audience of stakeholders, it had been largely overshadowed by the fundamental curricula problems in the discipline. A large portion of research …

Front Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Bytes Bite: Why Corporate Data Breaches Should Give Standing To Affected Individuals, Caden Hayes

Washington and Lee Journal of Civil Rights and Social Justice

High-profile data hacks are not uncommon. In fact, according to the Privacy Rights Clearinghouse, there have been at least 7,961 data breaches, exposing over 10,000,000,000 accounts in total, since 2005. These shocking numbers are not particularly surprising when taking into account the value of information stolen. For example, cell phone numbers, as exposed in a Yahoo! hack, are worth $10 a piece on the black market, meaning the hackers stood to make $30,000,000,000 from that one hack. That dollar amount does not even consider copies the hackers could make and later resell. Yet while these hackers make astronomical payoffs, the …

Cybersecurity And The Protection Of Digital Assets: Assessing The Role Of International Investment Law And Arbitration, Julien Chaisse, Cristen Bauer

Vanderbilt Journal of Entertainment & Technology Law

The digital era provides many opportunities, yet it also presents several unique challenges with regard to cybersecurity and the protection of digital assets. Cybercrime has changed the international legal landscape as nations, businesses, and legislators grapple with how to deal with this rapidly evolving, multifaceted problem. As there is no international mechanism for protection of foreign investors in this regard, some scholars are advocating for the use of Bilateral Investment Treaties (BITs) as part of a 'olycentric" approach to cyber peace. With an uptick in digital development and more development on the horizon, it will be important to establish what …

Crashworthy Code, Bryan H. Choi

Washington Law Review

Code crashes. Yet for decades, software failures have escaped scrutiny for tort liability. Those halcyon days are numbered: self-driving cars, delivery drones, networked medical devices, and other cyber-physical systems have rekindled interest in understanding how tort law will apply when software errors lead to loss of life or limb. Even after all this time, however, no consensus has emerged. Many feel strongly that victims should not bear financial responsibility for decisions that are entirely automated, while others fear that cyber-physical manufacturers must be shielded from crushing legal costs if we want such companies to exist at all. Some insist the …

Table Of Contents, Seattle University Law Review

Seattle University Law Review

No abstract provided.

The Privacy Hierarchy: A Comparative Analysis Of The Intimate Privacy Protection Act Vs. The Geolocational Privacy And Surveillance Act, Katherine A. Mitchell

University of Miami Law Review

The advent of the technological boom brought the world smartphones, social media, and Siri. These novel benefits, however, were accompanied by unchartered invasions of privacy. Congress has embarked on the seemingly endless path of protecting its constituents through civil and criminal legislation aimed at combatting such invasions. Two recent examples include the Intimate Privacy Protection Act (“IPPA”) and the Geolocational Privacy and Surveillance Act (“GPS Act”). Nonetheless, the IPPA, which was proposed to criminalize the dissemination of nonconsensual pornography, has garnered much less support—and much more criticism—than its geolocational counterpart.

This Note discusses the striking similarities of both bills, both …

Breaches Within Breaches: The Crossroads Of Erisa Fiduciary Responsibilities And Data Security, Gregg Moran

University of Miami Law Review

Although the drafters of the Employee Retirement Income Security Act of 1974 (“ERISA”) likely could not have anticipated the data security issues of the twenty-first century, ERISA’s duty of prudence almost certainly requires employee benefit plan fiduciaries to protect sensitive participant data in at least some manner. This Article suggests the Department of Labor should issue a regulation clarifying fiduciaries’ data security obligations. Given that fiduciaries are in the best positions to recognize their plans’ individual security needs and capabilities, the regulation should not attempt to micromanage fiduciaries’ substantive data security policies; rather, it should focus on the procedures by …

Deepfakes: False Pornography Is Here And The Law Cannot Protect You, Douglas Harris

Duke Law & Technology Review

It is now possible for anyone with rudimentary computer skills to create a pornographic deepfake portraying an individual engaging in a sex act that never actually occurred. These realistic videos, called “deepfakes,” use artificial intelligence software to impose a person’s face onto another person’s body. While pornographic deepfakes were first created to produce videos of celebrities, they are now being generated to feature other nonconsenting individuals—like a friend or a classmate. This Article argues that several tort doctrines and recent non-consensual pornography laws are unable to handle published deepfakes of non-celebrities. Instead, a federal criminal statute prohibiting these publications is …

Data-Informed Duties In Ai Development, Frank A. Pasquale

Faculty Scholarship

Law should help direct—and not merely constrain—the development of artificial intelligence (AI). One path to influence is the development of standards of care both supplemented and informed by rigorous regulatory guidance. Such standards are particularly important given the potential for inaccurate and inappropriate data to contaminate machine learning. Firms relying on faulty data can be required to compensate those harmed by that data use—and should be subject to punitive damages when such use is repeated or willful. Regulatory standards for data collection, analysis, use, and stewardship can inform and complement generalist judges. Such regulation will not only provide guidance to …

Introductions, Tonya M. Evans, Julia Spivak

Law Faculty Scholarship

An introduction to the Symposium and an introduction to Blockchain technology in preparation for the topics of the rest of the symposium.

The Role Of International Rules In Blockchain-Based Cross-Border Commercial Disputes, Tonya M. Evans

Law Faculty Scholarship

[excerpt] The concept of online dispute resolution (ODR) is not new. 1 But, with the advent of Web 3.0, the distributed web that facilitates pseudonymous and cross-border transactions via blockchain's distributed ledger technology, 2 the idea of, and pressing need for, appropriate dispute resolution models for blockchain-based disputes to support this novel system of distributed consensus and trust of which blockchain proponents boast, is a primary concern in rapid development. 3 The common goal of each project is to utilize smart contracts to facilitate "superior, quicker[,] and less expensive proceedings by eliminating so many of the tedious and protracted trappings …

The Human Element: The Under-Theorized And Underutilized Component Vital To Fostering Blockchain Development, Joshua A.T. Fairfield

Scholarly Articles

This Article constitutes a lightly edited transcription of Joshua Fairfield's oral remarks at the April 6, 2018 Cleveland State Law Review Symposium on Blockchain Law and Technology.

The author posits that there is a tendency to think that technology will emerge triumphant in resolving physical problems, including banking and transactional recording; that there is sort of a "tech-bro utopianism," epitomized by Mark Zuckerberg, suggesting that what we need is a technological, not a human, solution. He states that one major problem is that social technologists, psychologists, historians, linguists, and cultural anthropologists are not on the development teams that are building …

Panel Iii: Practicing Blockchain Law, 34 Uic J. Marshall J. Priv. & Tech. L. 52 (2019), Peter Nadimi, Samuel Korver, Zach Smolinski, Lauren Steinhaeuser, Corey Bieber

UIC John Marshall Journal of Information Technology & Privacy Law

The most disruptive technology to emerge in the past decade, blockchain technology has had an immediate impact on the legal industry to address the new issues that blockchain, cryptocurrencies, and distributed ledger technologies present. This panel discusses why it is important for lawyers to take an interest in this area, and more importantly, how lawyers of all experience levels can get involved in the blockchain space. The panel will share diverse experiences and insights from those on the ground who do blockchain legal work.

Panel I: Blockchain And The Law, 34 Uic J. Marshall J. Priv. & Tech. L. 1 (2019), Carla Reyes, Nelson Rosario, Rachel Cannon, Richard Tall

UIC John Marshall Journal of Information Technology & Privacy Law

The most disruptive technology to emerge in the past decade, blockchain technology has had an immediate impact on the legal industry to address the new issues that blockchain, cryptocurrencies, and distributed ledger technologies present. This panel provides an overview of blockchain technology, including current and potential applications, and discusses how blockchain intersects with various sectors of the law. The panelists define this new technology, identify potential legal challenges ahead, and explain how new and seasoned attorneys can engage in this emerging area.

Panel Ii: Blockchain Regulation And Criminal Law, 34 Uic J. Marshall J. Priv. & Tech. L. 31 (2019), Justin Steffen, Michele Korver, Elaine Wyder-Harshman, Michael Baumert, Emily Hayes

UIC John Marshall Journal of Information Technology & Privacy Law

The most disruptive technology to emerge in the past decade, blockchain technology has had an immediate impact on the legal industry to address the new issues that blockchain, cryptocurrencies, and distributed ledger technologies present. This panel discusses current and potential regulatory issues facing blockchain technology, including ICOs and securities regulation, prevention of blockchain use in criminal activities, the uncertain tax landscape, and the unique challenges of regulating a global borderless technology.

Can Accessibility Liberate The "Lost Ark" Of Scholarly Work?: University Library Institutional Repositories Are "Places Of Public Accommodation”, 52 Uic J. Marshall L. Rev. 327 (2019), Raizel Liebler, Gregory Cunningham

UIC Law Review

For any body of knowledge – an ark of power or a corpus of scholarship – to be studied and used by people, it needs to be accessible to those seeking information. Universities, through their libraries, now aim to make more of the scholarship produced available for free to all through institutional repositories. However, the goal of being truly open for an institutional repository is more than the traditional definition of open access. It also means openness in a more general sense. Creating a scholarship-based online space also needs to take into consideration potential barriers for people with disabilities. This …

Annual Report, 2019 (Five Year Report 2013-2019)

Tech Policy Lab

With this report, we celebrate the Tech Policy Lab’s five-year anniversary. We are deeply grateful to the community for helping us mark this milestone. We came together in the fall of 2013 to create a deeply interdisciplinary research collaboration with real-world impacts. We chose to model our new collaboration on a laboratory—a place to experiment with a distinct interdisciplinary model for research, to develop tangible and innovative new resources, and to train the next generation of tech policy experts. With co-equal faculty directors from three distinct disciplines, and students and faculty from many more, we set out to bridge the …